It’s been one year since we announced our security analytics platform. We decided to start by doing one thing exceedingly well, and that was incident investigation against massive piles of data. Since then, a few changes have occurred…and we’ve continued to expand the platform. For example, during the past year we added support for EDR data, one of the largest sets of telemetry in many companies, and announced a new partnership with Tanium for EDR integration. We also added the ability to pivot from a device to a user, and to see normal vs. unusual user behavior quickly.
We’ve recently added several new interesting capabilities.
The first is intelligent data fusion, a combination of a specialized data model that maps incoming telemetry into a flexible structure; automatic enriching and linking of events into a timeline; and an API to serve this data to third party applications, in addition to our UI. Analysis against enriched events simplifies detection rule authoring as well as investigations.
The second is a new threat detection capability, in addition to high speed investigation. We’ve not only added a new realtime and retrospective execution engine, but we’ve also created YARA-L, a specialized threat detection language for log data. YARA is a widely used and standard language for expressing security rules, created by the VirusTotal team here at Google. We’ve extended that capability with a powerful language for expressing behavioral detection over time. It’s well-suited to handle the types of complex, sequenced threat behaviors described in Mitre ATT&CK.
The two capabilities work together so that customers can create powerful detection rules against intelligent, auto-enriched and structured telemetry. We make this available in our UI as well as through a new API that other security vendors can use to enhance their own products.
“Cortex XSOAR offers automated enrichment, response and case management to enterprise-wide threats,” said Rishi Bhargava, VP, Product Strategy at Palo Alto Networks. “The integration with Chronicle’s new detection capabilities and event timelines, across months or years’ of data, enhances that response and enables comprehensive threat management for our mutual customers.”
We’ve continued to work with a growing set of security vendors, to integrate their log data into our platform. We’ve just added Acalvio, SIEMplify, Swimlane, and Vectra, each announcing new integrations with Chronicle. Here’s to a great year ahead!